setup-devadvokit

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill writes user-provided data to a file in the user's home directory (~/.devadvokit.md) as its primary function.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by saving unsanitized user input into a file that other skills are expected to read. * Ingestion points: Responses provided by the user during the guided setup interview in SKILL.md. * Boundary markers: None; the output file uses standard Markdown formatting without delimiters for untrusted content. * Capability inventory: The skill utilizes file-writing capabilities to generate the configuration file. * Sanitization: The skill does not perform validation or escaping on the user-supplied text before writing it to disk.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 03:50 PM